nss_compat allocates buffer space on stack using alloca (and
extend_alloca) for initgroup and keeps extending it to fit in larger
lines. This breaks for cases where the number of members in a gorup
are very large, causing the alloca reference to go beyond thread stack
boundary. I have posted a patch on libc-alpha that implements a fallback to malloc/free if the buffer size needed is beyond __libc_alloca_cutoff:

http://sourceware.org/ml/libc-alpha/2012-02/msg00503.html

How reproducible:
Always

Steps to Reproduce:
1. In /etc/nsswitch.conf:

group: compat
group_compat: files

2. Create a large number of users for a single group

for i in $(seq 1 70000); do
 useradd -M -N -s /sbin/nologin -G foo somelongusernameaaaaaaaaaaaa$i
 echo Created somelongusername$i
done

3. Start nscd
4. groups somelongusernameaaaaaaaaaaaa100

Actual results:
nscd crashes

Expected results:
nscd does not crash

Additional info:

This is also possible with ldap (the original case is with ldap):

group: files compat
group_compat: ldap